{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2025-57819",
  "revision": 1,
  "title": "Sangoma FreePBX — unsanitised input opens the administrator",
  "summary": "FreePBX 15, 16 and 17 do not sanitise user input on some endpoints, which lets an unauthenticated attacker reach the administrator interface, manipulate the database and run code on the telephony server.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.85463,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2025-08-29",
    "prerequisites": "Network access to the FreePBX endpoints; no credentials needed."
  },
  "remediation": {
    "patch_available": true
  },
  "mitre_attack": [
    "T1190"
  ],
  "kill_chain": "initial_access",
  "recommended_action": "Apply the patched endpoint versions now and lock the administrator interface to trusted addresses; exploit code is public, so audit trunks and call records.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2025-57819",
      "retrieved_at": "2026-09-24T08:51:39.744Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-09-24T08:51:39.744Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2025-57819",
      "retrieved_at": "2026-09-24T08:51:39.744Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2025-57819",
      "retrieved_at": "2026-09-24T08:51:39.744Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57819",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203"
    },
    {
      "type": "vendor_advisory",
      "url": "https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h"
    },
    {
      "type": "exploit",
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819"
    }
  ],
  "published_at": "2025-08-28T17:15:36.790Z",
  "issued_at": "2026-09-24T08:51:39.744Z",
  "tags": [
    "sangoma",
    "freepbx",
    "telephony",
    "authentication-bypass",
    "sql-injection",
    "kev"
  ]
}